CVE-2020-7713: 
JavaScript vulnerability analysis and mitigation

CVE-2020-7713 affects all versions of the package arr-flatten-unflatten, which contains a Prototype Pollution vulnerability. The vulnerability was disclosed on August 13, 2020, and published on September 1, 2020 (Snyk).

The vulnerability allows Prototype Pollution via the constructor in the arr-flatten-unflatten package. The package, which provides a non-recursive method of flattening an array of arrays and unflattening the result, is susceptible to prototype manipulation through its unflatten function. The vulnerability has been assigned CWE-1321 and received a CVSS v3.1 score of 7.5 (High) from Snyk (Snyk).

When exploited, this vulnerability can lead to Denial of Service (DoS), potential Remote Code Execution (RCE), or Property Injection. In DoS scenarios, the attacker can pollute Object.prototype attributes causing application failures. For RCE, code execution is possible if the application evaluates and executes specific object attributes. Property Injection allows attackers to manipulate security-critical properties like privileges (Snyk).

A proof-of-concept exploit exists that demonstrates how the vulnerability can be triggered. The exploit involves using the unflatten function with a specially crafted object: const { unflatten } = require('arr-flatten-unflatten'); unflatten({'proto.polluted':true}); console.log(polluted); (Snyk).

There is no fixed version available for arr-flatten-unflatten. Recommended mitigations include: freezing the prototype using Object.freeze(Object.prototype), implementing JSON input schema validation, avoiding unsafe recursive merge functions, using objects without prototypes (Object.create(null)), and considering Map instead of Object as a best practice (Snyk).